Static analysis flagged many external command and URL patterns, but review shows they are documented belt CLI examples for an AI video workflow, not hidden execution or exfiltration. The weak cryptographic algorithm findings at SKILL.md lines 3 and 75 are false positives caused by ordinary descriptive text. Residual risk remains medium because the skill instructs users to authenticate to and send prompts, image URLs, audio URLs, and video URLs to external inference.sh services.
External CLI Execution for Remote Video Generation
The skill permits and documents belt CLI commands that authenticate with and run remote AI video applications. This is an expected feature, but it executes external commands and can transmit user prompts or media references to a third-party service.
The allowed-tools entry explicitly permits belt commands, and examples invoke belt app run. The behavior is legitimate for the skill, but the external execution and remote processing risk is clear.
Several examples pass image, audio, and video URLs into remote model runs. Users may expose private media or sensitive source URLs if they use non-public assets without reviewing provider handling.
The examples directly show URL fields supplied to model invocations. The risk depends on user inputs and provider policy, so it is medium rather than high.
The hardcoded URLs point to inference.sh documentation, an image asset, install instructions, and placeholder user media URLs. They support documentation and examples rather than covert network destinations.
The URLs are visible markdown links or placeholder media inputs. No evidence found of obfuscation, tracking endpoints, or credential exfiltration.
Weak Cryptography Static Finding Is False Positive
The high static findings at lines 3 and 75 do not reference cryptographic functions or algorithms. They appear to match ordinary prose in the description and table header.
Manual review found no cryptographic implementation or configuration on these lines. The evidence is limited to descriptive text and a markdown table header.